Security & Audit

3 ideas

• An audit of our own app found hardcoded credentials that every prior read had missed shipped
  The findings were only surfaced because we ran a deliberate audit, which means the same class of mistake had been shipping unnoticed for as long as the app had existed.
• A protocol reported claimable rewards that did not exist when claimed shipped
  The reported figure was an estimate computed under assumptions that no longer held at claim time, so trusting it and batching on top of it spent gas on claims that returned nothing.
• A liquidity pool that showed a price chart and held no liquidity shipped
  The pool existed as a contract producing chart-shaped data without holding reserves, so the aggregator rendered a market that had nothing behind it.